A command injection flaw in Industrial Application Software IAS Canias ERP 8.03 allows an attacker to pass a malicious troiaCode argument to the RMI interface, causing the server to execute arbitrary OS commands through Runtime.getRuntime.exec. This results in full compromise of the affected system’s confidentiality, integrity, and availability. The CVSS score of 5.3 reflects a moderate severity, indicating that while the vulnerability is exploitable, the impact level is not critical.

The sole affected product is IAS Canias ERP version 8.03. No other versions are listed, and a patch or fix has not yet been released by the vendor. The vulnerability lies in the component that handles the RMI interface, which is exposed over the network.

The exploit is publicly released and can be triggered remotely through the RMI endpoint, which may be reachable from the external network. With no EPSS data available, the likelihood of exploitation cannot be quantified, but the absence of a vendor response and publicly available exploit code indicates a real threat. The CVSS score of 5.3 suggests moderate severity; however, the remote nature of the vector elevates the risk of widespread misuse if the RMI interface is not protected.